Vulnerabilities

CVSS

10.0 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk score

80.0

Published

2026-08-10

Status

Published

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

Weaknesses

CWE-89

Coverage 1

vulnerability

Multiples vulnérabilités dans Metabase (24 août 2026)

Multiple vulnerabilities have been discovered in Metabase, allowing attackers to potentially compromise data confidentiality through SQL injection and an unspecified security issue. These vulnerabilities affect older ver…

CERT-FR · 6d ago Medium

CVE-2026-72898CVE-2026-72899CVE-2026-72900sql injectionvulnerabilitymetabase

All articles mentioning it

Advisories and references

• github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59
• cve.org/CVERecord?id=CVE-2026-72899
• raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2...